ieee80211_process_callback() use in drivers

[PseudoCylon]

On Wed, Aug 17, 2011 at 8:31 PM, Adrian Chadd <adrian at freebsd.org> wrote:
> On 18 August 2011 10:10, PseudoCylon <moonlightakkiy at yahoo.ca> wrote:
>
>>> Hm, I fixed the status check in the BAR TX routines.
>>> Is that enough? Or are you saying that the node ref is freed somewhere
>>> inside ic_raw_xmit() on a TX failure?
>>
>> Sorry, I found the commit after replied.
>>
>> But, drivers call ieee80211_free_node() in ic_raw_xmit() on failure.
>
> Hm, so we can't kill the free, because ieee80211_ref_node() is called early on.
> So if ic->ic_raw_xmit(), just return ret, rather then "goto bad" ?
>

Other mgmt frame Tx functions, i.e ieee80211_send_mgmt(), refs node
and expects ic_raw_xmit() to free node whether on success or on
failure. So, drivers free node after calling
ieee80211_process_callback() or in ic_raw_xmit() on failure. So, ref
count is kept balanced.

But, ieee80211_send_bar() frees node. So that, on failure in
ic_raw_xmit(), drivers need first to test if it is a BAR frame. If
not, free node; if so, don't free node because ieee80211_send_bar()
does by its self. Otherwise node would be freed twice on one ref.